4 ms·

> You need to start that because, as we recently learned, at some point in the very near future Apple is withdrawing its Advanced Data Protection (ADP) feature

by sedatk 1y ago

> You need to start that because, as we recently learned, at some point in the very near future Apple is withdrawing its Advanced Data Protection (ADP) feature from the UK altogether as a result of the Home Office TCN through the Investigatory Powers Act. So, a UK-only advice, and it strangely assumes that any other service in UK wouldn’t be bound by the same laws.

omnicognate 1y ago
I can encrypt anything and store it in anything that provides storage. Why are people acting like "end to end encryption" is a feature you need a cloud service to provide to you. Rather the opposite - it's really something you can only do yourself.
- culi 1y ago
  Sure, but almost no one is managing their own keys and knows enough about the various e2ee algorithms to make these decisions on their own. Do you know of a good piece of software or tool that lets a layperson interface with any cloud storage provider?
  - jank199x 1y ago
    https://github.com/restic/restic https://github.com/restic/restic not exactly for a "layperson", to be honest, but easy enough for someone familiar with a command line
    - NetMageSCW 1y ago
      So entirely unusable by any layperson, or the majori of the population.
      - herewulf 1y ago
        Obviously the majority of the population needs to elect better leaders, or failing that, be out in the streets over this. But they aren't. They don't care and there lies the real problem.
  - Kerrick 1y ago
    The closest I've found is VeraCrypt, which is near the edge of what I'd call layperson-friendly. But if you store a VeraCrypt drive on the cloud, you'll need to re-upload the entire encrypted file--usually quite large--every time you change anything at all. That's a _lot_ of bandwidth, and likely to be quite slow to sync.
  - MattTheRealOne 1y ago
    https://cryptomator.org/ https://cryptomator.org/
  - tucnak 1y ago
    Sparsebundles
- ajsnigrutin 1y ago
  And you must then give the password to your data. https://thblegal.com/news/can-i-be-prosecuted-for-failing-to-provide-my-password-to-the-police/ https://thblegal.com/news/can-i-be-prosecuted-for-failing-to... https://www.ilfattoquotidiano.it/in-edicola/articoli/2025/01/02/british-journalist-could-face-years-in-prison-for-refusing-to-hand-over-his-passwords-to-the-police/7822432/ https://www.ilfattoquotidiano.it/in-edicola/articoli/2025/01... etc.
  - omnicognate 1y ago
    In the extremely unlikely event that I'm compelled to by a judge, yes. Or if someone chooses to beat me with five dollar wrench, of course. And even then A) it can't happen without my knowledge and B) I have the option of refusing and bearing the consequences. I didn't say it solves every problem, just that it's the only way to have proper end-to-end encryption.
  - hex4def6 1y ago
    This seems like a job for a truecrypt style system. Either you do it at a file-level, or you have it split into (say) 10MB file chunks, and if you want to access a certain file you have an encrypted local db that acts as a magic decoder ring ("file test.csv is spread across CLOUD1.DB CLOUD3443.DB CLOUD132.DB"). Combine that with steganography (Enter real_password, and test.csv is a list of bank accounts, enter fake_password, and test.csv is a list of apple store locations, enter random_password, and it decodes junk). Maybe combine that with multiple layers of passwords (one ring to rule them all, except certain files). Obviously, you'd want to steganographize the decoder ring as well.
draw_down 1y ago
[dead]
caconym_ 1y ago
> So, a UK-only advice So what? > it strangely assumes that any other service in UK wouldn’t be bound by the same laws. From the linked article: > I’m not going to tell you where to move your stuff other than to say that if you’re moving it from one big tech company to another, you’re just being daft. Likewise, if you’re moving your stuff to a non-e2ee service, don’t bother. If you need an e2ee service try Proton. They have a Black Friday sale on.
- sedatk 1y ago
  > So what? The title felt like there was a greater issue with Apple specifically. There wasn't. There was a greater issue with the new UK laws and cloud storage systems. I think people deserved a clarification before getting wound up about it before reading the article.
  - caconym_ 1y ago
    The issue is with Apple specifically in the sense that they have been offering a superior E2EE cloud storage service that will soon be denied to UK residents (IIUC, E2EE isn't offered by their competition e.g. Google, Microsoft). But the article goes out of its way in its first section to note that Apple isn't in the wrong at all here: > But I will say that the shutdown of ADP is Apple being on the right side of the geopolitical fight, as inconvenient as that may be to you and me. It is, if you care about the issues the author evidently cares about, "time to start de-Appling". I am a satisfied ongoing customer of Apple and I didn't find this headline to be the least bit inflammatory. It is, at worst, minor clickbait—but it's not really bait at all, since the contents of the article match the headline.
  - cmsj 1y ago
    FYI, this is not about a law, this is about a Technical Capability Notice. This is a thing the UK government is able to issue to a specific company or companies, that require them to implement technical measures to enable data collection. This applies only to the company/ies that the notice is issued to. That could be one of them, some of them or all of them, but it's not really a law that automatically applies to all of them.
graemep 1y ago
> So, a UK-only advice Not for long
kcartlidge 1y ago
> So, a UK-only advice, and it strangely assumes that any other service in UK wouldn’t be bound by the same laws. I suspect it's because whilst other services would be affected we only know about Apple currently and, thanks to iOS and Mac, a large percentage of the population will be using Apple by default for the services impacted. Only Google (Android) and Microsoft (Windows) really overlap in that regard.
endgame 1y ago
Other countries have very similar regimes these days.

by sedatk 1y ago

omnicognate 1y ago

I can encrypt anything and store it in anything that provides storage. Why are people acting like "end to end encryption" is a feature you need a cloud service to provide to you. Rather the opposite - it's really something you can only do yourself.

culi 1y ago
Sure, but almost no one is managing their own keys and knows enough about the various e2ee algorithms to make these decisions on their own. Do you know of a good piece of software or tool that lets a layperson interface with any cloud storage provider?
- jank199x 1y ago
  https://github.com/restic/restic https://github.com/restic/restic not exactly for a "layperson", to be honest, but easy enough for someone familiar with a command line
  - NetMageSCW 1y ago
    So entirely unusable by any layperson, or the majori of the population.
    - herewulf 1y ago
      Obviously the majority of the population needs to elect better leaders, or failing that, be out in the streets over this. But they aren't. They don't care and there lies the real problem.
- Kerrick 1y ago
  The closest I've found is VeraCrypt, which is near the edge of what I'd call layperson-friendly. But if you store a VeraCrypt drive on the cloud, you'll need to re-upload the entire encrypted file--usually quite large--every time you change anything at all. That's a _lot_ of bandwidth, and likely to be quite slow to sync.
- MattTheRealOne 1y ago
  https://cryptomator.org/ https://cryptomator.org/
- tucnak 1y ago
  Sparsebundles
ajsnigrutin 1y ago
And you must then give the password to your data. https://thblegal.com/news/can-i-be-prosecuted-for-failing-to-provide-my-password-to-the-police/ https://thblegal.com/news/can-i-be-prosecuted-for-failing-to... https://www.ilfattoquotidiano.it/in-edicola/articoli/2025/01/02/british-journalist-could-face-years-in-prison-for-refusing-to-hand-over-his-passwords-to-the-police/7822432/ https://www.ilfattoquotidiano.it/in-edicola/articoli/2025/01... etc.
- omnicognate 1y ago
  In the extremely unlikely event that I'm compelled to by a judge, yes. Or if someone chooses to beat me with five dollar wrench, of course. And even then A) it can't happen without my knowledge and B) I have the option of refusing and bearing the consequences. I didn't say it solves every problem, just that it's the only way to have proper end-to-end encryption.
- hex4def6 1y ago
  This seems like a job for a truecrypt style system. Either you do it at a file-level, or you have it split into (say) 10MB file chunks, and if you want to access a certain file you have an encrypted local db that acts as a magic decoder ring ("file test.csv is spread across CLOUD1.DB CLOUD3443.DB CLOUD132.DB"). Combine that with steganography (Enter real_password, and test.csv is a list of bank accounts, enter fake_password, and test.csv is a list of apple store locations, enter random_password, and it decodes junk). Maybe combine that with multiple layers of passwords (one ring to rule them all, except certain files). Obviously, you'd want to steganographize the decoder ring as well.

draw_down 1y ago

[dead]

caconym_ 1y ago

> So, a UK-only advice So what? > it strangely assumes that any other service in UK wouldn’t be bound by the same laws. From the linked article: > I’m not going to tell you where to move your stuff other than to say that if you’re moving it from one big tech company to another, you’re just being daft. Likewise, if you’re moving your stuff to a non-e2ee service, don’t bother. If you need an e2ee service try Proton. They have a Black Friday sale on.

sedatk 1y ago
> So what? The title felt like there was a greater issue with Apple specifically. There wasn't. There was a greater issue with the new UK laws and cloud storage systems. I think people deserved a clarification before getting wound up about it before reading the article.
- caconym_ 1y ago
  The issue is with Apple specifically in the sense that they have been offering a superior E2EE cloud storage service that will soon be denied to UK residents (IIUC, E2EE isn't offered by their competition e.g. Google, Microsoft). But the article goes out of its way in its first section to note that Apple isn't in the wrong at all here: > But I will say that the shutdown of ADP is Apple being on the right side of the geopolitical fight, as inconvenient as that may be to you and me. It is, if you care about the issues the author evidently cares about, "time to start de-Appling". I am a satisfied ongoing customer of Apple and I didn't find this headline to be the least bit inflammatory. It is, at worst, minor clickbait—but it's not really bait at all, since the contents of the article match the headline.
- cmsj 1y ago
  FYI, this is not about a law, this is about a Technical Capability Notice. This is a thing the UK government is able to issue to a specific company or companies, that require them to implement technical measures to enable data collection. This applies only to the company/ies that the notice is issued to. That could be one of them, some of them or all of them, but it's not really a law that automatically applies to all of them.

graemep 1y ago

> So, a UK-only advice Not for long

kcartlidge 1y ago

> So, a UK-only advice, and it strangely assumes that any other service in UK wouldn’t be bound by the same laws. I suspect it's because whilst other services would be affected we only know about Apple currently and, thanks to iOS and Mac, a large percentage of the population will be using Apple by default for the services impacted. Only Google (Android) and Microsoft (Windows) really overlap in that regard.

endgame 1y ago

Other countries have very similar regimes these days.